Salesforce compliance mapping
Every Salesforce finding is mapped to the controls of the compliance frameworks Vulkro ships, through the finding's category.
vulkro-sf compliance report --framework pci ./force-app # sox, pci, hipaa or gdpr
vulkro-sf compliance bundle soc2 ./force-app # auditor package
You can also read the rollup in the local console (vulkro-sf serve, Compliance tab) or ask for it from an AI coding agent with the MCP tool sf_run_compliance_report. Its frameworks are pci, hipaa, soc2, nist-ssdf, nist-800-53 (alias stateramp), iso27001, cis-v8, cwe-top25, gdpr and owasp-asvs.
NIST SP 800-53 Rev. 5 (StateRAMP)
StateRAMP uses the NIST 800-53 control catalog, so stateramp resolves to the same mapping and the report header says "NIST SP 800-53 Rev. 5 (StateRAMP profile)".
| Control | Salesforce findings that feed it |
|---|---|
| AC-2 Account management | Hardcoded credentials in metadata; unauthenticated endpoints; Connected App secrets in source |
| AC-3 Access enforcement | CRUD/FLS bypass; object-level and function-level authorization gaps on Apex REST and @AuraEnabled; without sharing on request-reachable classes |
| AC-4 Information flow | Sharing mode: with vs without sharing, WITH SECURITY_ENFORCED, Security.stripInaccessible |
| AC-6 Least privilege | Profile and permission set over-grants (ModifyAllData, AuthorApex, CustomizeApplication); Connected App Full scope |
| AU-2 Audit events | Sensitive flows without rate or anti-automation controls |
| IA-5 Authenticator management | Hardcoded passwords; Named Credential passwords and Connected App <consumerSecret> in metadata |
| SC-8 Transmission confidentiality | http:// Named Credential endpoints and Connected App callback URLs |
| SC-13 Cryptographic protection | Weak or deprecated algorithms (MD5, SHA-1) |
| SI-7 Integrity | Known vulnerabilities in dependencies |
| SI-10 Input validation | SOQL injection; mass assignment; Visualforce XSS (escape="false", merge field in script) |
| CM-7 Least functionality | Dangerous OAuth scopes; exposed debug endpoints |
SOC 2
| Control | Salesforce findings that feed it |
|---|---|
| CC6.1 | Apex routes without auth; @AuraEnabled methods with no profile or FLS check |
| CC6.6 | Profile over-grants on non-admin profiles |
| CC6.7 | Callouts to URLs without an allowlist |
| CC6.8 | Standard-object PII fields returned by Apex REST, Visualforce or LWC (see the PII map) |
| CC7.1 | Sensitive flows without rate or anti-automation controls |
| CC7.2 | Known vulnerabilities in dependencies and static resources |
| CC9.1 | Hardcoded secrets in metadata; cleartext Named Credential endpoints; Connected App Full scope |
Not covered yet
- FedRAMP overlays beyond the NIST 800-53 baseline, and StateRAMP impact-level overlays.
- Salesforce-specific wording in the PCI mapping (the generic
pcimapping applies to every finding).
See also: Compliance overview, vulkro-sf compliance